Upgrade to react 19

[RomanHotsiy]

I also upgraded the testing library as the @testing-library/react-hooks is deprecated.

Fixes #423

A few notable changes:

• useMemo typings in react changed so deps argument can't be undefined anymore (I updated in the code)
• one test was giving 2 instead of 3 renders. I didn't have time to dig, @avkonst maybe you would understand it faster but if you're busy let me know, I can dig
• updated test code in one place as the renderHook from @testing-library/react doesn't return error but throws instead

[phylum-io]

Phylum OSS Supply Chain Risk Analysis - FAILED

This repository analyzes the risk of new dependencies. An
administrator of this repository has set requirements via Phylum policy.

If you see this comment, one or more dependencies have failed Phylum's risk analysis.

Package: cjs-module-lexer@1.4.3 failed.

cjs-module-lexer@1.4.3 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: core-js@3.42.0 failed.

core-js@3.42.0 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: core-js-pure@3.42.0 failed.

core-js-pure@3.42.0 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: es-module-lexer@1.7.0 failed.

es-module-lexer@1.7.0 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: eta@1.14.2 failed.

Eta vulnerable to Code Injection via templates rendered with user-defined data

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

XSS Attack with Express API

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

Package: jiti@1.21.7 failed.

jiti@1.21.7 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: postcss@8.5.3 failed.

postcss@8.5.3 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: prismjs@1.30.0 failed.

prismjs@1.30.0 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: psl@1.15.0 failed.

psl@1.15.0 references suspicious URLs.

Risk Domain: Malicious Code
Risk Level: medium

Reason: Suspicious URL reference

Package: registry-auth-token@5.1.0 failed.

registry-auth-token@5.1.0 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: tailwindcss@3.4.17 failed.

tailwindcss@3.4.17 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: terser@5.39.2 failed.

terser@5.39.2 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: undici@6.21.3 failed.

undici@6.21.3 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: webpack@5.99.9 failed.

webpack@5.99.9 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: yaml@2.8.0 failed.

yaml@2.8.0 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: @algolia/client-search@5.25.0 failed.

@algolia/client-search@5.25.0 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

View this project in the Phylum UI

[RomanHotsiy]

The lock file is generated using pnpm 7.30.0, not sure why it breaks builds.

[RomanHotsiy]

Hey @avkonst.

Would you be able to take a look at this PR this week?

[avkonst]

Hi, thank you for contribution. I am not able to look at this week but will try on weekend or next week. Could you please investigate what changed in the rerender from 2 to 3? That will help a lot

[RomanHotsiy]

@avkonst do you need any help maybe?

[phylum-io]

Phylum OSS Supply Chain Risk Analysis - FAILED

This repository analyzes the risk of new dependencies. An
administrator of this repository has set requirements via Phylum policy.

If you see this comment, one or more dependencies have failed Phylum's risk analysis.

Package: axios@1.9.0 failed.

Axios is vulnerable to DoS attack through lack of data size check

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

Package: cjs-module-lexer@1.4.3 failed.

cjs-module-lexer@1.4.3 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: core-js@3.42.0 failed.

core-js@3.42.0 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: core-js-pure@3.42.0 failed.

core-js-pure@3.42.0 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: es-module-lexer@1.7.0 failed.

es-module-lexer@1.7.0 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: eta@1.14.2 failed.

Eta vulnerable to Code Injection via templates rendered with user-defined data

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

XSS Attack with Express API

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

Package: form-data@3.0.3 failed.

form-data uses unsafe random function in form-data for choosing boundary

Risk Domain: Software Vulnerability
Risk Level: critical

Reason: Critical or High software vulnerability

Package: form-data@4.0.2 failed.

form-data uses unsafe random function in form-data for choosing boundary

Risk Domain: Software Vulnerability
Risk Level: critical

Reason: Critical or High software vulnerability

Package: glob@10.4.5 failed.

glob CLI: Command injection via -c/--cmd executes matches with shell:true

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

Package: jiti@1.21.7 failed.

jiti@1.21.7 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: postcss@8.5.3 failed.

postcss@8.5.3 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: prismjs@1.30.0 failed.

prismjs@1.30.0 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: psl@1.15.0 failed.

psl@1.15.0 references suspicious URLs.

Risk Domain: Malicious Code
Risk Level: medium

Reason: Suspicious URL reference

Package: registry-auth-token@5.1.0 failed.

registry-auth-token@5.1.0 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: tailwindcss@3.4.17 failed.

tailwindcss@3.4.17 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: terser@5.39.2 failed.

terser@5.39.2 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: undici@6.21.3 failed.

undici@6.21.3 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: webpack@5.99.9 failed.

webpack@5.99.9 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: yaml@2.8.0 failed.

yaml@2.8.0 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: @algolia/client-search@5.25.0 failed.

@algolia/client-search@5.25.0 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

View this project in the Phylum UI

[avkonst]

Hi @RomanHotsiy . Sorry for dropping the ball here, life carried over with changes and I am overloaded over the board now. If you can help that would be great. If you could investigate the remaining two tests failing, suggest a fix in PR and I will merge. If you would like to take more active role in the project. I am happy to share as well.

[gdenchev]

Hi, I just cloned the repo with the PR, ran the tests (pnpm test) to see which tests fail.

I got only one test failing - the last one in Error.tsx in core, starting on line 46:
test('error: should not allow serialization of statelink', async () => {

But this is caused by recent commit 22bc57a, which does NOT throw 109 in dev mode.

If I revert to b271f18, all tests seem to pass.

Maybe I'm doing something odd, but I see no problem with the current tests and the PR?

If possible, can you direct me to the failing tests, I want to try and help :)

Disclaimer: I'm no Hookstate source code expert, just use it in projects, and will be glad to see it support React 19.

[avkonst]

Thanks for helping. I believe PR needs to be rebased to the latest mainline then run the tests. The expectation is the tests are passing. Sorry guys, I was extremely busy with a start up, relocated recently to a new city, all that makes it very difficult to give it time. Happy to merge and release if you complete the PR.

…

On Wed, Jan 21, 2026 at 5:15 AM gdenchev ***@***.***> wrote: *gdenchev* left a comment (avkonst/hookstate#425) <#425 (comment)> Hi, I just cloned the repo with the PR, ran the tests (pnpm test) to see which tests fail. I got only one test failing - the last one in Error.tsx in core, starting on line 46: test('error: should not allow serialization of statelink', async () => { But this is caused by recent commit 22bc57a <22bc57a>, which does NOT throw 109 in dev mode. If I revert to b271f18 <b271f18>, all tests seem to pass. Maybe I'm doing something odd, but I see no problem with the current tests and the PR? If possible, can you direct me to the failing tests, I want to try and help :) Disclaimer: I'm no Hookstate source code expert, just use it in projects, and will be glad to see it support React 19. — Reply to this email directly, view it on GitHub <#425 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AA6JSVKBOVXQBP77EYUM5SL4HZICLAVCNFSM6AAAAAB55EYP4CVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTONZTG42TIMRSHE> . You are receiving this because you were mentioned.Message ID: ***@***.***>